[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[bug#41363] knot-resolver: Enable reloading of policy files (add lua-cqu

From: Ludovic Courtès
Subject: [bug#41363] knot-resolver: Enable reloading of policy files (add lua-cqueues)
Date: Wed, 17 Jun 2020 12:02:33 +0200
User-agent: Gnus/5.13 (Gnus v5.13) Emacs/26.3 (gnu/linux)


Julien, could you take a look at this patch series?  I figured you
probably know Knot better than I do.

Thanks in advance,

Simon South <> skribis:

> This patch series enables the automatic reloading of response-policy
> zone (RPZ) files by Knot Resolver. Specifically these patches
> - Add package definitions for the cqueues Lua extension module and the
>   luaossl module on which it relies, and
> - Add lua5.1-cqueues as an input to knot-resolver.
> With these changes applied, Knot Resolver can be configured with lines
> like
>     modules = { 'policy' }
>     policy.add(policy.rpz(policy.DENY, '/etc/dns/blacklist.txt', true))
> and it will automatically reload RPZ rules from /etc/dns/blacklist.txt
> whenever that file changes. This makes it easy to use Knot Resolver to
> block unwanted sites using a list of domains downloaded periodically
> from the Internet.
> I've tested these changes on x86-64 and aarch64. On x86-64 everything
> works as expected.
> On aarch64, the packages build and install fine but Knot Resolver fails
> to load the configuration above with
>     policy.lua:430: [poli] lua-cqueues required to watch and reload RPZ file
> This is due to a known issue with LuaJIT on aarch64 (see e.g.
>     $ ./pre-inst-env guix environment knot-resolver --ad-hoc knot-resolver
>     $ $(head -n 3 `which kresd` | tail -n 2)  # set LUA_PATH, LUA_CPATH
>     $ luajit -e 'require("cqueues")'
>     luajit: bad light userdata pointer
>     stack traceback:
>             [C]: at 0xffffa556a960
>             [C]: in function 'require'
>             ...
>     $
> Otherwise (i.e. after changing "true" to "false" in the configuration
> above) Knot Resolver continues to work as it did before, so I expect
> existing users will not be affected.
> I'll work on diagnosing the upstream bug but thought I'd submit these
> patches in the meantime.
> --
> Simon South

reply via email to

[Prev in Thread] Current Thread [Next in Thread]